UsingGeo-Targetingto Block Visitors byIPAddressLocation

A geo-targeted firewall in action - allowing some countries, returning HTTP 451 to others.

Sometimes you genuinely need to block visitors from a specific country. Maybe a content licensing deal restricts you to one region, maybe a sanctions list legally requires it, maybe a fraud cluster keeps hitting you from one ASN. Whatever the reason, geo-blocking is one of the oldest tools in the web operator's kit - and in 2026 it's also one of the easiest ways to accidentally erase your brand from AI search.

This guide covers when geo-blocking is the right call, how to implement it cleanly at the CDN layer, the legal landmines to avoid, and the one rule you have to follow if you don't want ChatGPT, Claude and Perplexity to lose visibility on your brand.

1. When geo-blocking actually makes sense

Most blanket geo-blocks are over-engineered. Before adding one, ask whether you can solve the same problem with a softer approach - showing a region-specific notice, redirecting to a localised domain, or simply not advertising in that market. Real reasons to block:

2. Block at the CDN, not in your app

The single most important rule: enforce geo-blocks as far upstream as possible. CDN-level rules at Cloudflare, Fastly, CloudFront or Akamai run before the request ever reaches your origin - they're faster, cheaper, harder to bypass, and they protect you from being DDoSed by traffic you were going to reject anyway.

// Cloudflare Worker - block by country, allow AI crawlers
const BLOCKED_COUNTRIES = new Set(["IR", "KP", "SY", "CU"]);
const AI_BOT_AGENTS = [
  "GPTBot", "ClaudeBot", "PerplexityBot",
  "Google-Extended", "anthropic-ai", "CCBot",
];

export default {
  async fetch(request) {
    const country = request.cf?.country ?? "XX";
    const ua = request.headers.get("user-agent") ?? "";

    // Always allow AI crawlers - they keep your brand in AI search
    const isAIBot = AI_BOT_AGENTS.some((b) => ua.includes(b));

    if (BLOCKED_COUNTRIES.has(country) && !isAIBot) {
      return new Response("Not available in your region.", {
        status: 451,
      });
    }

    return fetch(request);
  },
};

Note the explicit HTTP 451 status. It tells well-behaved clients (and Googlebot) that the block is intentional and legal, not an error.

3. Know the legal landscape

Geo-blocking is legal almost everywhere - in fact, it's required in plenty of places. The main exception is the EU's Geo-blocking Regulation, which restricts unjustified country-based discrimination inside the single market for certain categories. It does not ban geo-blocking - it bans unjustified geo-blocking, with broad exemptions for licensing, copyright and regulated services.

In the US, there's no general restriction; sanctions compliance (OFAC) is the main driver. In the UK, UK financial sanctions and OFCOM rules apply. As always, run your specific setup past legal counsel before flipping the switch.

4. The mistake that kills AI search visibility

Here's the part most geo-blocking guides still don't cover. Both Googlebot and the major AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, anthropic-ai) crawl from a tiny set of mostly-US IP ranges. If you blanket- block anycountry those crawlers operate from, you're not just blocking users - you're removing your brand from the training data and live index of every major AI assistant.

The fix is the explicit allow-list pattern shown above. Always check the User-Agent (and ideally verify against the published IP ranges) before blocking. AI crawlers should always see the canonical, non-personalised, non-blocked version of your content.

5. How geo-blocking interacts with GEO

That's the core of what every Geolify GEO package checks for as part of the build. We audit your CDN rules, robots.txt, and crawler allow-lists to make sure your AI search visibility isn't silently being throttled by a firewall rule someone added two years ago.

For a deeper dive on how each AI assistant handles location and trust signals differently, the per-platform playbooks for ranking in ChatGPT, Claude and Perplexity are the right next read.

Recap

Geo-blocking is a legitimate, often legally-required tool - but it's also the easiest way to silently kill your AI search presence. The rules are simple: block at the CDN, return HTTP 451, document the legal basis, and always allow-list the AI crawler user agents so the brands you build for human users in one region keep getting cited by AI assistants for users in every other region.

FAQ